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Dear Attorney General Coakley: 

Pursuant to M.G.L. c. 93H, we are writing to notify you of an unauthorized access of 
personal information involving two (2) Massachusetts residents. 

Information about the Incident 


In the spring of 2009 the mailroom of our Los Angeles office received a phone call from 
an individual stating that he had found papers containing the names and certain personal 
information about partners of our firm near an office of a firm that provides tax services to us. 
The caller also indicated that the papers included a header including an individual's name and 
stated that he would return the information by mail to the firm. This incident was reported to the 
local office administrator who relayed it to Latham's Chief Tax Officer. The Chief Tax Officer 
recognized the individual named by the caller as one of the persomiel of the firm engaged to 
provide tax services to the firm. The tax firm was contacted. They conducted an investigation 
that concluded that the call was likely made by a former romantic interest of the individual 
mentioned in the call and that the caller was attempting to disrupt the individual's career. There 
were no fiirther calls and nothing was received by the firm or the tax firm until April 5, 2011, 
when a recently postmarked envelope arrived in the film's San Diego mail room. The package 
contained a six (6) page report on paper with a header including the name mentioned in the 2009 
call. The report contained the names, social security numbers and certain other information of 
some individuals who were partners of the firm in 2007. Two of those individuals have since 
retired and relocated to Massachusetts (the firm did not have an office in Massachusetts at that 
time, although it does now). 
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Number of Massachusetts Residents Affected 

As noted above, the number of affected individuals residing in Massachusetts is two (2), 
These Massachusetts residents have received or will shortly receive notice pursuant to M.G.L. c. 
93H, s. 3(b). The method of delivery is in writing by U.S. Mail. A copy of the notice is attached. 

Actions in Response 

The San Diego mail room staff notified the local office administrator of the receipt of the 
material who in turn contacted the Chief Tax Officer. The firm’s data breach incident response 
protocol was activated. The tax firm was contacted again and they worked with us and an 
outside security consultant to conduct an investigation. The investigation included an interview 
of the individual named in the 2009 call, public records research of the individuals involved, 
consultation with a behavioral physiologist, research to determine whether any of the 
information involved appeared to have been misused, and other work. The investigation 
concluded (a) that the material was likely sent by the former romantic interest after he learned 
that the individual named in the 2009 call had become engaged to a third party and that it was 
again as part of an effort to disrupt her career, (b) that no other use had been made of the material 
mailed to the firm and (c) that in the absence of any actionable evidence connecting the former 
romantic interest to the mailing, seeking to interview or otherwise contact him was more likely to 
result in further disclosure than simply ignoring him. 

The matter has not been reported to local law enforcement in accordance with the advice 
of our outside security consultant. There is no evidence that any of the material has been used 
for fraudulent purposes. We do not plan to offer credit monitoring services at this time. We 
have consulted with the tax firm to assure that their procedures concerning the handling of tax 
preparation materials duly secure printed material containing personal information of firm 
personnel and to otherwise protect firm information in both electronic and paper form. 

Other Notification and Contact Information 

A copy of this notice has been provided to the Massachusetts Director of Consumer 
Affairs. Should you have any questions or need further information concerning this matter, 
please contact Kevin Boyle at 202-637-2245. 


Sincerely, 



cc: Mr. Daniel Crane, Undersecretary 

Office of Consumer Affairs and Business Regulation 
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File No. 900000-0081 


We are writing to notify you that an unauthorized acquisition of your persona! information occurred at 
some point during the spring of 2009. We became aware that a breach occurred in April of 2011. The 
firm’s data breach incident response protocol was activated and the incident has been investigated by 
outside security consultants retained by the firm. We have no evidence that the information has been 
disseminated or that it has been used for fraudulent purposes. 


Under Massachusetts law, you have the right to obtain any police report filed in regard to this incident. If 
you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it. 
Massachusetts law also allows consumers to place a security freeze on their credit reports. A security 
freeze prohibits a credit reporting agency from releasing any information from a consumer’s credit report 
without written authorization. However, please be aware that placing a security freeze on your credit 
report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, 
credit mortgages, employment, housing or other services. 

If you have been a victim of identity theft, and you provide the credit reporting agency with a valid police 
report, it cannot charge you to place, lift or remove a security freeze. In all other cases, a credit reporting 
agency may charge you up to $5.00 each to place, temporarily lift, or permanently remove a security 
freeze. 


To place a security freeze on your credit report, you must send a written request to each of the three 
major consumer reporting agencies: Equifax (www.equifax.com); Experian (www.experian.com); and 
TransUnion (www.transunion.com) by regular, certified or overnight mail at the addresses below: 

• Equifax Security Freeze 
P.O. Box 105788 
Atlanta, GA 30348 

• Experian Security Freeze 
P.O. Box 9554 

Allen, TX 75013 

® Trans Union Security Freeze 

Fraud Victim Assistance Department 
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P.O. Box 6790 
Fullerton, CA 92834 

In order to request a security freeze, you will need to provide the following information; 

Your full name (including middle initial as well as Jr., Sr., II, III, etc.); 

Social Security Number; 

Date of birth; 

If you have moved in the past five (5) years, provide the addresses where you have lived over the 
prior five years; 

Proof of current address such as a current utility bill or telephone bill; 

A legible photocopy of a government issued identification card (state driver’s license or ID card, 
military identification, etc.) 

If you are a victim of identity theft, include a copy of either the police report, investigative report, 
or complaint to a law enforcement agency concerning identity theft; 

If you are not a victim of identity theft, include payment by check, money order, or credit card 
(Visa, MasterCard, American Express or Discover only). Do not send cash through the mail. 

The credit reporting agencies have three (3) business days after receiving your request to place a security 
freeze on your credit report. The credit bureaus must also send written confirmation to you within five (5) 
business days and provide you with a unique personal identification number (PIN) or password, or both 
that can be used by you to authorize the removal or lifting of the security freeze. 

To lift the security freeze in order to allow a specific entity or individual access to your credit report, you 
must call or send a written request to the credit reporting agencies by mail and include proper 
identification (name, address, and social security number) and the PIN number or password provided to 
you when you placed the security freeze as well as the identities of those entities or individuals you would 
like to receive your credit report or the specific period of time you want the credit report available. The 
credit reporting agencies have three (3) business days after receiving your request to lift the security 
freeze for those identified entities or for the specified period of time. 

To remove the security freeze, you must send a written request to each of the three credit bureaus by mail 
and include proper identification (name, address, and social security number) and the PIN number or 
password provided to you when you placed the security freeze. The credit bureaus have three (3) business 
days after receiving your request to remove the security freeze. 

Please contact me at 202-637-2245 if you have any questions concerning this matter. 

Sincerely, 
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Kevin C. Boyle 

of LATHAM & WATKINS LLP 





